Apache Airflow - Unauthorized Access to DAG Warnings
Summary
CVE-2023-42780: Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. Affects apache-airflow versions < 2.7.2. Fixed in 2.7.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2023-42780 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define tasks and their dependencies as directed acyclic graphs (DAGs). The platform provides a web-based interface for managing and visualizing these workflows. However, prior to version 2.7.2, Apache Airflow contained a security vulnerability that allowed authenticated users to list warnings for all DAGs, even if they did not have permission to view those DAGs. This vulnerability exposed sensitive information such as DAG IDs and stack traces of import errors for those DAGs with import issues.
Vulnerability Detail
The vulnerability in Apache Airflow allowed authenticated users to bypass access restrictions and view warnings for all DAGs, regardless of their permissions. This could potentially lead to unauthorized access to sensitive information and expose details about the system's workflow structure. The disclosure of DAG IDs and import error stack traces could aid attackers in identifying potential weaknesses or exploiting vulnerabilities in the system. The vulnerability was assigned a CVSS score of 6.5, indicating a medium severity level.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of Apache Airflow.
Conclusion
The vulnerability in Apache Airflow allowed authenticated users to bypass access restrictions and view warnings for all DAGs. Upgrading to version 2.7.2 or newer is recommended to mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows.
A DAG (Directed Acyclic Graph) in Apache Airflow represents a workflow, where tasks are defined as nodes and dependencies between tasks are represented as edges.
The vulnerability allows authenticated users to view warnings for all DAGs, even if they do not have permission to access those DAGs. This can lead to unauthorized access to sensitive information and expose details about the system's workflow structure.
To fix this vulnerability, upgrade to Apache Airflow version 2.7.2 or newer, which includes a patch to prevent unauthorized access to DAG warnings.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
